I think tunnelling is pretty common on networks divided into zones. It allows you to cross a zone but requires authentication. Effectively the same as a VPN but

I think tunnelling is pretty common on networks divided into zones. It allows you to cross a zone but requires authentication. Effectively the same as a VPN but you don't need 1 VPN per zone. A zone is basically just a logical boundary like "DMZ" for systems directly exposed to the internet, semi-trusted for machines accessible from the internet by other machines (like through a proxy or load balancer), and trusted/private for machines not accessible from the internet. There's newer stuff like Tailscale that makes some of these obsolete and can introduce software routing rules so you could access arbitrary things through a single connection regardless of where they live from a network perspective.